1. Field of the Invention
The invention relates to digital automatic flight control systems, particularly with respect to data management apparatus therefor.
2. Description of the Prior Art
Present day digital automatic flight control system channels traditionally utilize dual digital processors responsive to the same or similar data with cross processor monitoring for detecting random failures or generic design errors in the channels, thereby providing fail passive performance. The dual processors may be identical with respect to each other in hardware and software performing identical tasks. Alternatively, the processors may provide dissimilar data processing with respect to each other while performing identical tasks. In this arrangement, the processors may be dissimilar with respect to hardware, with respect to software or with respect to both hardware and software. A further dual processor fail passive arrangement is disclosed in copending patent application Ser. No. 739,583 filed May 30, 1985 in the names of the present inventors, and entitled "Digital Automatic Flight Control System with Disparate Function Monitoring". In the system of said Ser. No. 739,583 the dual processors are similar with respect to each other in hardware and software, but perform disparate tasks over disjoint computation paths with respect to each other. One of the processors performs an automatic flight control system function, while the other processor executes a monitor for that function to determine if the aircraft if performing in a manner prohibited by the function.
The two processors may have access to a single data sensor set traditionally including a plurality of sensor subsystems to provide input information to the processors for controlling the aircraft. Each subsystem provides a plurality of data items formatted as a sequence of words or bytes. Typically a byte may comprise eight bits. One such subsystem comprises the air data computer subsystem that provides data with respect to Mach, airspeed, dynamic pressure, vertical speed and the like. Another such subsystem is the attitude and heading reference system (AHRS) that provides such data as roll and pitch attitude, heading, accelerations and body rates utilized, for example, to stabilize the inner loops of the automatic flight control system. Another such input data subsystem is the navigation subsystem providing such data as present position, velocity, acceleration and the like. The output from each subsystem containing the sequence of bytes therefrom may be considered as a data message from the subsystem.
In such digital automatic flight control systems, it is desirable to utilize a single, bit serial data bus to convey the data messages from the sensor subsystems to the processors. The single bus architecture is simpler in hardware configuration, less bulky, less expensive and lighter weight than, for example, a parallel bus architecture, which qualities are significant for efficacious utilization in present day aircraft. In such a single, bit serial data bus system, a large amount of data is transferred between the sensor subsystems and the processor inputs during each iteration of the flight control program. Since the data transfer is bit serial, the data rates utilized are extraordinarily high. Conventionally, one of the dual processors controls the bus timing and accepts all of the data utilizing such well known techniques as direct memory accessing, program interrupts or sensor polling. During the computation cycle of the flight control program, the data acquiring processor utilizes the data in the programs stored therein and also provides the data to the second processor for the redundant or dissimilar processing in the cross-processor monitoring arrangement to detect random faults and generic design errors as discussed above.
In such a system, the data receiving processor may corrupt the input data, utilize the corrupted data in its own processing and send the corrupted data to the other processor for cross-processor monitoring purposes. Since the data utilized by both processors is identical, although erroneous, the cross-processor monitoring may detect the same although incorrect outputs from both processors thereby not detecting that an error has occurred. Under such circumstances, dangerous data may propagate to the control surface servos to precipitate a hazardous situation. Specifically, in the system of said Ser. No. 739,583, utilizing similar processors but task dissimilarity, if the dissimilar tasks require the same data and corrupted data is utilized in performing the automatic flight control system functionality and the corresponding monitoring, the system of said Ser. No. 739,583 may not detect the erroneous situation thereby propagating a hazardous condition. Such undetected hazardous malfunctions may also result from the data receiving processor destroying data, scrambling data message blocks with respect to the sensor subsystems and scrambling data within the data message blocks.
Another prior art arrangement utilizing two processors that require the same data is the provision of a buffer to hold the data such that both processors have access thereto when required. Such an arrangement is utilized when inputting analog data via an analog-to-digital converter associated with each processor. Such an arrangement is not utilized with digital data and is completely impractical with the high speed, bit serial data transfer described above.